First, I'd like to point out this is not considered a 2-step verification process because all of the components you suggest are "something you know." In order to have 2-step verification, you must have "something you are" (e.g. biometrics) or "something you have" (e.g. a security key or Google Authenticator token). See Wikipedia under "Components" for Two-Factor Authentication.
The only advantage to this process would be that if the user's email is compromised, this may prevent an attacker from being able to reset their password. However, security questions are often predictable and one can research the target to find the answers; such as birthday's and mother's maiden names which are often matters of public record.
Thus, while it does have some minimal security advantages, a system like this shouldn't be construed to be "two factor authentication" and instead is just "additional security questions" of questionable value. By allowing password resets based on security questions which may be researched by an attacker, you actually open up a separate attack vector/vulnerability as well.